CVE-2024-26933: USB: core: Fix deadlock in port "disable" sysfs attribute
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix deadlock in port "disable" sysfs attribute
The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if another process has locked the hub to remove it or change its configuration:
Removing the hub or changing its configuration requires the hub interface to be removed, which requires the port device to be removed, and devicedel() waits until all outstanding sysfs attribute callbacks for the ports have returned. The lock can't be released until then.
But the disableshow() or disablestore() routine can't return until after it has acquired the lock.
The resulting deadlock can be avoided by calling sysfsbreakactiveprotection(). This will cause the sysfs core not to wait for the attribute's callback routine to return, allowing the removal to proceed. The disadvantage is that after making this call, there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, we have to acquire a reference to it first by calling hubget().
Other sources
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix deadlock in port "disable" sysfs attribute
The Linux kernel CVE team has assigned CVE-2024-26933 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26933-c18d@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a deadlock in port "disable" sysfs attribute. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26933?
CVE-2024-26933 is classified as a high-severity vulnerability due to the potential deadlock situation it causes in the Linux kernel.
How do I fix CVE-2024-26933?
To fix CVE-2024-26933, update your Linux kernel to version 6.1.84 or later, or apply the patches provided in the kernel updates.
What versions of the Linux kernel are affected by CVE-2024-26933?
CVE-2024-26933 affects versions of the Linux kernel prior to 6.1.84 and specific versions between 6.2.0 and 6.8.3.
What is the impact of CVE-2024-26933 on systems?
The impact of CVE-2024-26933 can lead to system instability due to deadlocks when attempting to disable USB ports.
Is CVE-2024-26933 specific to certain distributions?
CVE-2024-26933 affects multiple Linux distributions that utilize the vulnerable versions of the kernel.